***

title: API Credentials
description: 'How to create, manage, and rotate API credentials for the Moveworks API'
--------------------------------------------------------------------------------------

## Create an API Credential

<Steps>
  <Step title="Navigate to Credentials">
    Go to **HTTP Connectors > Credentials**
  </Step>

  <Step title="Click Create">
    Click **Create** to start the credential creation process.

    ![Create credential](https://files.readme.io/7817d4d13b0e246e86ec83dcca8402f5e97617ca4d9f872a092e884ed623fe2a-CleanShot_2025-10-16_at_11.25.45.png)
  </Step>

  <Step title="Configure your credential">
    Provide a **Credential Name** and choose a **Credential Type**:

    * **OAuth 2.0 w/ Client Credentials** (Recommended) — can be used to generate access tokens via the [OAuth Token endpoint](/api-reference/events-api/authentication/create-oauth-token)
    * **API Keys** — can be tested via the [Test Auth endpoint](/api-reference/events-api/authentication/test-auth)

    ![Credential types](https://files.readme.io/269bf4b0a0c3211cfbeca83a045dad87a19c2c64bbd9cf9a88d0f8b414661256-CleanShot_2025-10-16_at_11.27.16.png)
  </Step>
</Steps>

<Note title="Credentials Best Practices">
  * Credentials are never written to disk or stored in any way. They can only be viewed in plain text **once** on the Credentials screen. Only the hash of the credential is stored.
  * When an account is deactivated or deleted, any associated API keys will stop working.
  * Moveworks recommends **generating API keys using a dedicated service account** rather than an individual employee's user account. Using a service account enhances security by creating a stable, auditable identity for the integration that is not tied to a person's employment status.
</Note>

## Token Expiry Details

| Token Type                             | Expiry           |
| -------------------------------------- | ---------------- |
| Client IDs, Client Secrets, & API Keys | Never expire     |
| Access Tokens                          | Every 60 seconds |

## Rotation & Revocation

In the event that your credential is exposed or leaked, follow this process for token rotation:

<Steps>
  <Step title="Create a new credential">
    Create a new API key following the steps outlined above.
  </Step>

  <Step title="Update your integrations">
    Update your code or integrations to use the new API key.
  </Step>

  <Step title="Delete the old credential">
    Use the **trash icon** to delete the previous API key. Selecting delete will permanently invalidate the key.

    ![Delete credential](https://files.readme.io/90c4163e36a1c89326fe1283a3e9488274e503d4d1b4203a7420698f67c2e12a-CleanShot_2025-10-16_at_11.25.45.png)
  </Step>
</Steps>